W32/Kalel-B is a mass-mailing worm and backdoor Trojan that also targets peer-to-peer file sharing utilities.
W32/Kalel-B runs continuously in the background, providing a backdoor server, which allows a remote intruder to gain access and control over the computer.
W32/Kalel-B displays a message box displaying the following fake error message:
Fatal Error: Exception Code=C00000005
Called from - frmimportwizard.pageframe1.page2.command1.click line 70
Called from - mail line 613
W32/Kalel-B contacts the sites www.google.com and search.yahoo.com in order to harvest email addresses. The worm sends itself as an email attachment to these email addresses.
Messages are sent with the following subject line:
**WARNING** Mailbox Suspension
The message text is as follows:
This message was created automatically by mail delivery software (TMDA) - do not reply.
In order to safeguard your mailbox from unexpected termination, please read the attached document.
++ Attachment: No Virus found
++Norton AntiVirus
http://www.symantec.com
W32/Kalel-B is a mass-mailing worm and backdoor Trojan that also targets peer-to-peer file sharing utilities.
W32/Kalel-B runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer.
W32/Kalel-B displays a message box displaying the following fake error message:
Fatal Error: Exception Code=C00000005
Called from - frmimportwizard.pageframe1.page2.command1.click line 70
Called from - mail line 613
W32/Kalel-B contacts the sites www.google.com and search.yahoo.com in order to harvest email addresses. The worm sends itself as an email attachment to these email addresses.
Messages are sent with the following subject line:
**WARNING** Mailbox Suspension
The message text is as follows:
This message was created automatically by mail delivery software (TMDA) - do not reply.
In order to safeguard your mailbox from unexpected termination, please read the attached document.
++ Attachment: No Virus found
++Norton AntiVirus
http://www.symantec.com
When first run W32/Kalel-B copies itself to the following locations:
<Windows>\system\lsass.exe
<Windows>\system\services.exe
<Windows>\system\smss.exe
W32/Kalel-B may copy itself to any of the following folders:
C:\My Downloads\
C:\My Shared Folder\
C:\program files\Ares\My Shared Folder\
C:\program files\BearShare\Shared\
C:\program files\direct connect\received files\
C:\program files\eDonkey2000\incoming\
C:\program files\eMule\Incoming\
C:\program files\gnucleus\downloads\
C:\program files\gnucleus\downloads\incoming\
C:\program files\grokster\my grokster\
C:\program files\grokster\my shared folder\
C:\program files\icq\shared files\
C:\program files\KaZaa Lite\My Shared Folder\
C:\program files\KaZaa\My Shared Folder\
C:\program files\KMD\my shared folder\
C:\program files\limeWire\shared\
C:\program files\Morpheus\my shared folder\
C:\program files\rapigator\share\
C:\program files\shareaza\downloads\
C:\program files\StreamCast\Morpheus\my shared folder\
C:\programmi\Ares\My Shared Folder\
C:\programmi\BearShare\Shared\
C:\programmi\direct connect\received files\
C:\programmi\eDonkey2000\incoming\
C:\programmi\eMule\Incoming\
C:\programmi\gnucleus\downloads\
C:\programmi\gnucleus\downloads\incoming\
C:\programmi\grokster\my grokster\
C:\programmi\grokster\my shared folder\
C:\programmi\icq\shared files\
C:\programmi\KaZaa Lite\My Shared Folder\
C:\programmi\KaZaa\My Shared Folder\
C:\programmi\KMD\my shared folder\
C:\programmi\limeWire\shared\
C:\programmi\Morpheus\my shared folder\
C:\programmi\rapigator\share\
C:\programmi\shareaza\downloads\
C:\Programmi\StreamCast\Morpheus\my shared folder\
C:\shared\
W32/Kalel-B drops the following ZIP files, each containing a copy of the worm:
<Windows>\system\rockefeller64.zip
<Windows>\system\rockefeller65.zip
<Windows>\system\rockefeller66.zip
W32/Kalel-B drops the following files, each containing a copy of one of the above ZIP files in uuencoded format:
<Windows>\system\rundll16.ref
<Windows>\system\rundll32.ref
<Windows>\system\rundll64.ref
W32/Kalel-B drops a text file ROCKEFELLER.DAT in the folder <Windows>\system. This contains the following text:
W32.Rockerfeller@MM+P2P+BACKDOOR+KEYLOGGER
W32/Kalel-B may create further files with the following names:
<Windows>\system\rfdriver32.dll
<Windows>\system\mouse_drv16.ref
<Windows>\system\mouse_drv32.ocx
<Windows>\system\mouse_drv64.dat
The following registry entries are created to run the worm on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Windows Service Controller
<Windows>\system\services.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
MS Security Authority Service
<Windows>\system\lsass.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Windows Session Manager Subsystem
<Windows>\system\smss.exe